Reference: Anti-malware settings

When you create an Anti-Malware policy, you can add settings to control the user experience. These settings apply to both System Center Endpoint Protection (SCEP) and Windows Defender Antivirus unless they are labeled (SCEP only) or (Defender only).

Client Interface

Display additional text to clients when they need to perform an action

Set a custom message to display to users when they need to perform an action. The string must be less than 1024 characters.

Example: Contact our company help desk at 555-1212 for more help.

Display notifications to clients when they need to perform actions

Configure whether to display notifications to users when they need to perform an action.

Enable or do not configure this setting to display notifications to users when they need to perform an action.

Disable this setting to prevent notifications from being displayed to users.

Enable headless UI mode

Configure whether the Windows anti-malware user interface displays to users.

Enable this setting to hide the Windows anti-malware user interface from users.

Disable or do not configure this setting to show the Windows anti-malware user interface to users.

Suppresses reboot notifications

Configure whether reboot notifications display to users.

Enable this setting to suppress reboot notifications.

Disable or do not configure this setting to display reboot notifications to users.

Exclusions

Extension Exclusions

Specify file extensions to exclude from scanning.

Example: obj

IP address range Exclusions

Specify IP addresses to exclude from network scanning.

Example: 157.1.45.123-60.1.1.1

Path Exclusions

Specify file paths to exclude from scanning.

Example: C:\Program Files

Port number Exclusions

Specify TCP ports to exclude from network scanning.

Example: 17472

Process Exclusions

Specify a path to a process to exclude all files opened by that process from scanning. Each value must be a full path to a process. The process itself is still scanned.

Example: C:\Windows\Program.exe

Process Exclusions for outbound traffic

Specify a path to a process to exclude outbound traffic from that process from network scanning.

Example: C:\Windows\Program.exe

Threat ID Exclusions

Exclude specific threats from network scanning.

Example: 2925110632

Turn off Auto Exclusions (Defender Only)

Turn Automatic Exclusions on or off.

Enable this setting to turn off Automatic Exclusions.

Disable or do not configure this setting to turn on Automatic Exclusions.

MAPS

Configure local setting override for reporting to MAPS

Allow the local preference for joining the Microsoft Active Protection Service to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Join MAPS

Join the Microsoft Active Protection Service. Possible values are:

Disabled
Basic MAPS
Advanced MAPS

Send file samples when further analysis is required

Configure how samples are sent to the Microsoft Active Protection Service. Possible values are:

Always prompt
Send safe samples
Never send
Send all samples

Network Inspection System

Define the rate of detection events for logging

Control the time interval in minutes for logging of detection events. Each event is logged at most once per time interval.

Default value: 60

Specify additional definition sets for network traffic inspection

Specify additional definition sets to enable for network scanning. Each value must be a GUID of a definition set to enable.

Example: {b54b6ac9-a737-498e-9120-6616ad3bf590}

Turn on definition retirement

Control whether known network vulnerabilities are scanned for after they are patched.

Enable or do not configure this setting to stop checking for network vulnerabilities after they are patched.

Disable this setting to always check for known network vulnerabilities.

Turn on protocol recognition

Control whether network protocol recognition is used to protect against attacks from known vulnerabilities.

Enable or do not configure this setting to enable network protocol recognition.

Disable this setting to disable network protocol recognition.

Quarantine

Configure local setting override for the removal of items from Quarantine folder

Allow the local preference for the number of days to keep items in the quarantine folder to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure removal of items from Quarantine folder

Define the number of days that items are kept in the quarantine folder before they are removed. By default, items remain in the quarantine folder indefinitely.

Example: 30

Real-time Protection

Configure local setting override for monitoring file and program activity on your computer

Allow the local preference for file and program activity to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for monitoring for incoming and outgoing file activity

Allow the local preference for monitoring of incoming and outgoing file activity to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for scanning all downloaded files and attachments

Allow the local preference for scanning downloaded files and attachments to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for turn on behavior monitoring

Allow the local preference for behavior monitoring to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for turn on script scanning (SCEP Only)

Allow the local preference for script scanning to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override to turn off Intrusion Prevention System

Allow the local preference for network scanning to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override to turn on real-time protection

Allow the local preference for turning on real-time protection to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure monitoring for incoming and outgoing file and program activity

Configure whether incoming or outgoing files are scanned. On servers with heavy network traffic, disabling scanning for a particular direction can help to achieve optimal network performance. This setting is applicable only to NTFS volumes.

Define the maximum size of downloaded files and attachments to be scanned

Configure the maximum size of downloaded files and attachments to scan. The value is the maximum file size in kilobytes.

Example: 524288

Monitor file and program activity on your computer

Configure monitoring of file and program activity.

Enable or do not configure this setting to turn on monitoring of file and program activity.

Disable this setting to turn off monitoring of file and program activity.

Scan all downloaded files and attachments

Configure scanning of downloaded files and attachments.

Enable or do not configure this setting to scan all downloaded files and attachments.

Disable this setting to turn off scanning of downloaded files and attachments.

Turn off real-time protection

Configure whether users are prompted when known malware is detected.

Enable this setting to never prompt users to take action when malware is detected.

Disable or do not configure this setting to prompt users to take action when malware is detected.

Turn on behavior monitoring

Turn behavior monitoring on or off.

Enable or do not configure this setting to enable behavior monitoring.

Disable this setting to enable behavior monitoring.

Turn on Information Protection Control

Turn Information Protection Control on or off.

Enable this setting to turn on Information Protection Control.

Disable or do not configure this setting to turn off Information Protection Control.

Turn on network protection against exploits of known vulnerabilities

Configure network protection from known vulnerabilities.

Enable or do not configure this setting to turn on network protection.

Disable this setting to turn off network protection.

Turn on process scanning whenever real-time protection is enabled

Configure whether all processes are scanned when real-time protection is first turned on. This scan can detect malware that starts when real-time protection is off.

Enable or do not configure this setting to start a process scan when real-time protection is turned on.

Disable this setting to not start a process scan when real-time protection is turned on.

Turn on raw volume write notifications

Configure notifications of raw volume writes.

Enable or do not configure this setting to turn on raw write notifications.

Disable this setting to turn off raw write notifications.

Turn on script scanning (SCEP Only)

Configure script scanning.

Enable or do not configure this setting to enable script scanning.

Disable this setting to disable script scanning.

Remediation

Configure local setting override for the time of day to run a scheduled full scan to complete remediation

Allow the local preference for the scheduled scan time to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Specify the day of the week to run a scheduled full scan to complete remediation

Schedule the day of the week to perform a full scan.

Specify the time of day to run a scheduled full scan to complete remediation

Specify the time of day to perform a full scan. The value is the number of minutes past midnight in the local time for the endpoint to perform the scan.

Example: 180

Reporting

Configure time out for detections in critically failed state

Set the time in minutes for a "critically failed" detection to move to "additional action" or be "cleared."

Example: 7200

Configure time out for detections in non-critical failed state

Set the time in minutes to "clear" a "non-critically failed" detection.

Example: 7200

Configure time out for detections in recently remediated state

Sets the time in minutes to "clear" a "completed" detection.

Example: 7200

Configure time out for detections requiring additional action

Set the time in minutes to "clear" an "additional action."

Example: 7200

Configure Watson events (SCEP Only)

Use this policy setting to configure whether or not Watson events are sent. This value has been deprecated as of the February 2015 anti-malware platform update. For more information, see Microsoft: February 2015 anti-malware platform update for Endpoint Protection clients.

Configure Windows software trace preprocessor components

Configure the Windows software trace preprocessor.

Configure WPP tracing level

Configure tracing levels for the Windows software trace preprocessor (WPP Software Tracing). The allowed values are Error (1), Warning (2), Info (3), or Debug (4).

Example: 1

Scan

Allow users to pause scan

Allow users to pause a scan while it is in progress.

Enable or do not configure this setting to add a new context menu to the task tray icon that allows users to pause a scan.

Disable this setting to prevent users from pausing scans.

Check for the latest virus and spyware definitions before running a scheduled scan

Check for new virus and spyware definitions before running a scan. This setting does not apply to scans started manually from the user interface.

Enable to check for new definitions before running a scan.

Disable or do not configure this setting for scans to use existing definitions.

Configure local setting override for maximum percentage of CPU utilization

Allow the local preference for maximum CPU utilization to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for schedule scan day

Allow the local preference for the scheduled scan day to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for scheduled quick scan time

Allow the local preference for the scheduled quick scan time to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for scheduled scan time

Allow the local preference for the scheduled scan time to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Configure local setting override for the scan type to use for a scheduled scan

Allow the local preference for the scan type to use during a scheduled scan to override the group policy.

Enable this setting for the local preference to have precedence over the group policy.

Disable or do not configure this setting for the group policy to have precedence over the local preference.

Create a system restore point

Configure whether a daily system restore point is created on an endpoint before it is cleaned.

Enable this setting to create a system restore point before cleaning.

Disable or do not configure this setting to prevent a system restore point from being created.

Define the number of days after which a catch-up scan is forced (Defender Only)

Specify the number of consecutive scheduled scans that can be missed until a forced catch-up scan runs.

Example: 2

Default value: 2

Run full scan on mapped network drives

Configure whether mapped network drives are scanned.

Enable this setting to scan mapped network drives.

Disable or do not configure this setting to prevent scanning mapped network drives.

Scan archive files

Configure whether archive files are scanned. Archive files are ZIP or CAB files.

Enable or do not configure this setting to scan archive files.

Disable this setting to prevent scanning archive files.

Scan network files

Configure whether network files are scanned.

Enable this setting to scan network files.

Disable or do not configure this setting to prevent scanning network files.

Scan packed executables

Configure whether packed executables are scanned.

Enable or do not configure this setting to scan packed executables. For best results, use this setting.

Disable this setting to prevent scanning of packed executables.

Scan removable drives

Configure whether removable drives, such as USB flash drives, are scanned when running a full scan.

Enable this setting to scan removable drives during any type of scan.

Disable or do not configure this setting to prevent scanning of removable drives in full scans. Removable drives can still be scanned during quick scans and custom scans.

Specify the interval to run quick scans per day

Configure the quick scan interval in hours. The value 0 means that quick scans are never scheduled.

Example: 24

Default value: 0

Specify the maximum depth to scan archive files

Set the maximum directory depth that archive files are unpacked during scanning. Archive files are ZIP or CAB files.

Example: 1

Default value: 0

Specify the maximum percentage of CPU utilization during a scan

Set the maximum percentage CPU utilization allowed during a scan. Valid percentage values can range from 5 to 50. The value 0 means that there is no limit.

Example: 5

Default value: 50

Specify the maximum size of archive files to be scanned

Set the maximum size of archive files that are scanned. Archive files are ZIP or CAB files. The value is the number of kilobytes. The value 0 means that there is no size limit.

Example: 1048576

Default value: 0

Specify the scan type to use for a scheduled scan

Specify the scan type used during scheduled scans. By default, scheduled scans use quick scans.

Specify the time for a daily quick scan

Specify the time of day when a daily quick scan runs. The value is the number of minutes past midnight in the local time for the endpoint to perform the scan.

Example: 180

Default value: 120

Start the scheduled scan only when computer is on but not in use

Set whether scans begin only when the endpoint is idle.

Enable or do not configure this setting to start scans only when the endpoint is idle.

Disable to start scans at the scheduled time.

Turn on catch-up full scan

Configure whether to start a full scan if two consecutive scheduled scans are missed. The full scan starts the next time someone logs in after the scheduled scans are missed.

Enable this setting to turn on catch-up full scans.

Disable or do not configure this setting to turn off catch-up full scans.

Turn on catch-up quick scan

Configure whether to start a quick scan if two consecutive scheduled scans are missed. The quick scan starts the next time someone logs in after the scheduled scans are missed.

Enable this setting to turn on catch-up quick scans.

Disable or do not configure this setting to turn off catch-up quick scans.

Turn on e-mail scanning

Configure whether email and email attachments are scanned.

Enable this setting to turn on email scanning.

Disable or do not configure this setting to turn off email scanning.

Turn on heuristics

Heuristics improve the capability to flag new threats.

Enable or do not configure this setting to turn on heuristics. For best results, use this setting.

Disable this setting to turn off heuristics.

Turn on removal of items from scan history folder

Configure the number of days that items are kept in the scan history folder before being permanently removed. The value 0 means that items are never removed from the history folder.

Example: 7

Default: 30

Turn on reparse point scanning

Configure whether reparse points are scanned. Reparse points are followed to a maximum depth, so a recursive reparse point might slow down scanning, but it does not cause an error.

Enable this setting to scan reparse points.

Disable or do not configure this setting to prevent reparse point scanning.

Signature Updates

Allow definition updates from Microsoft Update

Enable definition updates to be downloaded from Microsoft Update even if Automatic Updates are configured to use a different download source.

Enable this setting to download definition updates from Microsoft Update.

Disable or do not configure this setting to download definition updates from the configured source.

Allow definition updates when running on battery power

Configure whether definitions are updated when an endpoint is running on battery power.

Enable or do not configure this setting to update definitions even when an endpoint is running on battery power.

Disable this setting to turn off definition updates when an endpoint is running on battery power.

Allow notifications to disable definitions based reports to MAPS

Enable receiving notifications from MAPS to disable definitions that are causing false positives. MAPS must be configured on an endpoint to successfully use this functionality.

Enable or do not configure this setting to receive notifications from MAPS to disable definitions that are causing false positives.

Disable this setting to turn off receiving notifications from MAPS to disable definitions.

Allow real-time definition updates based on reports to MAPS

Enable real-time definition updates if MAPS finds that the latest definition update has definitions for a threat involving an unknown file. MAPS must be configured on an endpoint to successfully use this functionality.

Enable or do not configure this setting to enable real-time definition updates.

Disable this setting to turn off real-time definition updates.

Check for the latest virus and spyware definitions on startup

Specify whether definition updates should be checked at service startup.

Enable this setting to check for definition updates at service startup.

Disable or do not configure this setting to prevent checking for definition updates at service startup.

Define file shares for downloading definition updates

Set UNC file shares for downloading definition updates. The file shares are tried in the specified order.

Example: \\corp\updates

Define the number of days after which a catch-up definition update is required

Specify the number of days that can pass before a forced catch-up definition update.

Example: 7

Default value: 1

Define the number of days before spyware definitions are considered out of date

Set the number of days that can pass before spyware definitions are considered out of date.

Example: 7

Default value: 14

Define the number of days before virus definitions are considered out of date

Set the number of days that can pass before virus definitions are considered out of date.

Example: 7

Default value: 14

Define the order of sources for downloading definition updates

Specify the order for definition update sources to be contacted. Possible values are:

Microsoft Update
Microsoft Malware Protection Center
Internal definition update server
File shares

Initiate definition update on startup

Configure whether definitions are updated on startup when there is no antimalware engine.

Enable or do not configure this setting to enable definition updates on startup when no antimalware engine is present.

Disable this setting to turn off definition updates when no antimalware engine is present.

Specify the day of the week to check for definition updates

Specify the day of the week to check for definition updates. By default, updates are checked every day.

Specify the interval to check for definition updates

Specify the definition update check interval in hours.

Example: 12

Specify the time to check for definition updates

Specify the time of day to check for definition updates. The value is the number of minutes past midnight in the local time for the endpoint to check for definition updates. By default, definition updates are checked 15 minutes before the scheduled scan time.

Example: 120

Turn on scan after signature update

Configure whether a scan should start after a definition update.

Enable or do not configure this setting to start a scan after a definition update.

Disable this setting to not start a scan after a definition update.

System Center Endpoint Protect

Turn on Potentially Unwanted Application (PUA) detection (SCEP Only)

Block PUAs from being downloaded through Internet Explorer, Firefox, and Chrome.

Disable or do not configure this setting to disable improved PUA detection.

Turn on threat file hash logging (SCEP Only)

Determines whether or not the file hash (SHA1) of any detected threat files is recorded in the event log for additional research and correlation with other threat streams. When a threat file is detected and hash logging is enabled, EventID 1120 is recorded in the system log.

Enable this setting for events to be recorded.

Disable or do not configure this setting for threat file hashes to not be recorded to the event log.

Turn on virus definitions (SCEP Only)

Manage virus definitions used during a scan.

Enable or do not configure this setting for virus definitions to be used during scans.

Disable this setting for virus definitions to not be used during scans.

Threats

Specify threat alert levels at which default action should not be taken when detected

Customize the remediation action to take for each threat alert level.

Possible values for threat alert levels are:

Low
Medium
High
Severe

Possible values for remediation actions are:

Quarantine
Remove
Ignore

Specify threats upon which default action should not be taken when detected

Customize the remediation action to take for each detected Threat ID. Possible values for remediation actions are:

Quarantine
Remove
Ignore

Windows Defender

Allow antimalware service to remain running always

Choose whether the Windows Anti-malware service keeps running when virus and spyware definitions are disabled.

Enable this setting to keep the Windows Anti-malware service running when virus and spyware definitions are disabled.

Disable or do not configure this setting to stop the Windows Anti-malware service when virus and spyware definitions are disabled.

Allow antimalware service to startup with normal priority

Modify the startup priority of the Windows Defender service. This might impact performance.

Enable or do not configure this setting to start the Windows Anti-malware service with normal priority.

Disable this setting to start the Windows Anti-malware service with low priority.

Configure local administrator merge behavior for lists

Control whether local preferences for exclusions and threats are merged with the group policy.

Enable or do not configure this setting to merge local preferences with the group policy. Group policy settings take precedence over local preferences.

Disable this setting to ignore local preferences.

Define addresses to bypass proxy server

Bypass the proxy for a specific IP address. The value must be a valid URL.

Define proxy server for connecting to the network

Configure a proxy to use for downloading definition updates or reporting events to MAPS. By default, the following settings are used in order:

Internet Explorer proxy settings
Auto-detect
None

Randomize scheduled task times

Randomize the start time of scheduled tasks.

Enable or do not configure this setting for scheduled tasks to begin randomly within 30 minutes of their scheduled start time.

Disable this setting for scheduled tasks to begin at their scheduled start time.

Turn off routine remediation

Control whether Windows Anti-malware automatically remediates threats.

Enable this setting to prevent automatic remediation. Instead, users are prompted with a choice of actions to take.

Disable or do not configure this setting to automatically take action on all detected threats.

Turn off Windows Defender

Turn Windows Anti-malware on or off.

Enable this setting to turn off Windows Anti-malware.

Disable or do not configure this setting to turn on Windows Anti-malware.